Secure boot Certificate update for HP Probook 450 G5

[SpicyChicken]

The Secure Boot status in the registry is still stuck at “In Progress,” so I followed these steps:

Clear and re‑enroll keys:
In the BIOS, there is an option to clear Secure Boot keys and re‑enroll the factory defaults. This can sometimes refresh the certificate store if the update did not apply correctly.

After doing this, when Secure Boot is enabled, the system fails to boot and displays the error “Boot Device Not Found.” The only fix found so far is updating the BIOS; however, for this particular model, the latest BIOS update was released in 2025.

If Secure Boot is disabled, the system boots normally, but Secure Boot needs to remain enabled.

Has anyone here experienced this issue?

[ForumGuy]

Hi.

Applying Factory-Default Secure Boot Keys may not install the new Microsoft CA 2023 certificates automatically. You may have to install the new certificates or Secure Boot Keys manually. Factory default keys may not contain new keys if it was manufactured before 2024.

There is a thread at: https://h30434.www3.hp.com/t5/Business-Notebooks/Enabling-new-UEFI-2023-CA-certificates-in-pre-2018-...

You should carefully read the posts here at this thread, preferably several times, and decide if you would like to continue installing the keys yourself.

You should also read: https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-sec...

Please do note: Whatever you do, you do it at your own risk. There are several people who bricked their PCs badly because of Secure Boot Key management. Be especially carefull if you have HP Sure Start Tech incorporated into your PC, notebook or desktop.

[ForumGuy]

Hi again.

Did you read the Microsoft article whose link I provided ?

Did you resolve your boot issue ? If not, you can update your Windows installation to be able to boot into Windows when Secure Boot is enabled. You must update boot files in your EFI system partition. To do this, please follow the method below. But first check if you have EFI_EX folder in C:\Windows\Boot folder.:

If you do not have it, please advise. If you have it, then please continue.

First you must assign a drive letter S to the EFI system volume using Diskpart.

Exit Diskpart and then mount this volume.

In Command Prompt window opened with admin rights, run this command:

mountvol S: /S 

Then run these commands one by one (wait until each command finishes running and return to prompt):

COPY S:\EFI\MICROSOFT\BOOT\BCD S:\EFI\MICROSOFT\BOOT\BCD.BAK

bcdboot C:\Windows /f UEFI /s S: /bootex

COPY S:\EFI\MICROSOFT\BOOT\BCD.BAK S:\EFI\MICROSOFT\BOOT\BCD

mountvol S: /D

Now you should go into BIOS and enable Secure Boot and restart into Windows.

If you still have issues booting into Windows, please advise.

Hope this helps.  

Edit: Unfortunately, my commands are modified by the forum auto editor and it put some of my commands in two lines. They are one COPY line commands, not two.